Is Cloud Computing More Secure? (Opinion)

I recently received an e-mail advertising an upcoming online seminar. The intriguing title was Cloud Computing -- Faster, Better, Cheaper, Greener and More Secure. I paused, reread the session description and thought, "Oh, dear." If this premise is true, let's just move everything onto the cloud right now. We can save beaucoup bucks in government and sleep better at night at the same time. But while I can buy the first four outcomes, I'm not buying the last -- that it's more secure -- at least not yet. Here's why.

First, I want to offer the obligatory praise for cloud computing in general and the undeniable efficiencies available to state and local governments in particular. Yes, Michigan -- the government I work for -- has an exciting cloud strategy, like many other states. In fact, most technology vendors I know have one or more game-changing cloud offerings.

But this is about cloud security and specifically whether cloud computing is more secure than whatever your government is doing now. If you currently have weak security controls, you may be tempted to hand over your sensitive data to a cloud provider -- but read on before you do.

Proponents argue that the "big boys" like Microsoft and Google can secure systems better than most companies or government employees. At a recent panel discussion in Grand Rapids on this topic, I was challenged by other panelists with one-liners like: "Do you really think your security team is better than Google's?"

"Perhaps not. But that's not my point."

So what are a few of the most pressing cloud security problems?

• Our duty is to protect sensitive information, not just systems. Even if large cloud providers can protect servers better, your legal responsibility is to secure the information end-to-end.
• Off-the-shelf cloud policies, processes and procedures will probably not meet your need to comply with legal mandates, such as the Payment Card Industry compliance. By design, the more you demand specific requirements, the less the solution looks like cloud computing. If detailed terms and conditions are applied to services, cloud solutions will start to look like an outsourced contract and cost more.
• Where is your data? The global cloud knows no international borders, allowing for cheaper hosting overseas. But do laws (in other countries, like China) provide adequate protection of your rights if your provider goes bankrupt or doesn't comply with agreements? In addition, what if foreign countries don't enforce their own laws? What recourse will you have?
• Who owns (and has access to view) the logs at your cloud provider? Does this satisfy your audit responsibilities? Are e-discovery issues addressed? 
• In the event of a data breach, will your cloud provider be responsible for relevant costs? In most cases, state governments cannot indemnify contractors (or hold them harmless). Talk to your lawyers about relevant terms and conditions.

I could go on, but you get the picture. The more you specify unique security requirements, the harder it becomes to obtain the benefits of cloud computing. I do believe that new offerings will emerge in the coming years to address the essential requirements that most governments must address. However, I think we're a few years away from those opportunities becoming reality.

So what's a government technology leader to do in the meantime? First, you can start piloting the technology and create an internal government cloud. This will allow new flexibility to provision the infrastructure and software you need while maintaining more control over sensitive data within your environment.

Second, utilize cloud computing for publicly available data that's already accessible via the Freedom of Information Act. Large amounts of our government information can be placed in the cloud without risking breaches or many of the other issues identified.

Third, start talking with your vendor partners about new ways to secure your data in the cloud. There are many innovative technologies that are coming soon. I believe that the opportunities are huge over the next decade, and we need to build legal compliance into our plans.

Finally read about Google's recent experiences in China, which showcase some of the challenges that everyone faces as cloud computing progresses. Meanwhile, for the time being, our government technology future looks partly cloudy.